← Vulnerability feed

Vulnerability record · CVE-2026-0940 · published 11 March 2026

CVE-2026-0940: A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow …

A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to modify data and execute arbitrary code.

8.4 CVSS 4.0 High EPSS 0.13% · top 97.8% CWE-665 · CWE-665 Awaiting Analysis
8.4CVSS 4.0 base score
0.13%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to modify data and execute arbitrary code.

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://support.lenovo.com/us/en/product_security/LEN-213040

Track CVE-2026-0940 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2022-0847Linux kernel pipe buffer flaw allows local privilege escalationThe flags member of the new pipe buffer structure was not properly initialized in copy_page_to_iter_pipe and push_pipe, so it could hold stale values…KEVEPSS 93%analysed6.5CVE-2013-1675Mozilla Firefox and Thunderbird uninitialized memory information disclosureFirefox, Firefox ESR, Thunderbird and Thunderbird ESR fail to properly initialize the nsDOMSVGZoomEvent::mPreviousScale and mNewScale data structures…KEVEPSS 6.7%analysed5.5CVE-2020-27950Apple XNU kernel memory initialization flaw leaks kernel memoryA memory initialization issue in Apple's XNU kernel leaves kernel memory improperly initialized, allowing a malicious application to disclose kernel …KEVEPSS 17%analysed

Source: NIST National Vulnerability Database (record CVE-2026-0940), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.